cfn-lint
cfn-lint copied to clipboard
Detect invalid regexes in AllowedPattern property of parameters
cfn-lint version: (cfn-lint --version
)
cfn-lint 0.32.1
Description of issue. cfn-lint currently does not appear to validate that the contents of the AllowedPattern property of a template parameter contains a valid regular expression when present, it would be useful if cfn-lint could check this.
For example a template containing:
Parameters:
MyTestParameter:
Description: Test with invalid AllowedPattern
Type: String
AllowedPattern: '^abc|def)$'
ConstraintDescription: Must match AllowedPattern
Is not currently flagged by cfn-lint, but is rejected at runtime by CloudFormation due to the invalid regular expression in the AllowedPattern property which is missing a '(' at the second character.
CloudFormation uses java.util.regex.Pattern for regex parsing.
There will be some cases where the regex expressions do not evaluate to the same thing in Python in Java (which does not matter for this purpose), but I think some research needs to be done to check whether or not there are cases where an expression may considered valid in Python and not in Java and vice versa
similar to discussion here as well: https://github.com/aws-cloudformation/cloudformation-cli/pull/675#discussion_r566298712 Ideally patterns stick to a regular expression syntax subset valid in both Python and Java, but there are patterns invalid in Python that would be valid in Java